Comment 16 for bug 1474284

As a related point, there has been a RFE to allow for users from one backend to be placed in the group of another backend. As I recall this is related to the follow use-case:

LDAP / AD groups are not usable to Keystone (they are organization managed and do not match anything useful) and the OpenStack Cloud Admin wishes to use groups from within Keystone to manage grants.

This bug is semi-related in that if we pick one side or the other it will resolve the issue/make it more pronounced.